The present invention relates to a method and system for documenting the processes of an organization. Typically such processes form a control environment enabling internal control of the organization. The present invention also relates to a method and system for embedding the control environment in an organization. The present invention finds particular utility where an organization has engaged the services of an outsourcing agency to perform certain processes on their behalf.
An organization will typically have many processes, procedures and internal controls which must be carried out during the day to day running of the organization. The different processes together form the control environment of an organization. There may be standard processes for taking on and training new staff, for example, or for more routine matters such as ordering office consumables. Many of these processes will require different members of the organization to perform different tasks: a manager may need to authorise payment for stationary ordered by a subordinate, for example. To further complicate matters, many organizations now choose to outsource various internal processes to specialist outsourcing agencies under an outsourcing engagement. The outsourcing engagement may cover only a few individual processes or may cover a substantial proportion of the control environment.
Clearly, documenting processes can be useful under some circumstances, but may be vital under others. Where there is an outsourcing engagement involved, for example, it is important to document processes to ensure that the organization and the outsourcing agency perform the tasks required of them and that there is a measure of accountability should errors occur. Furthermore, it may be a legal requirement for an organization to carefully document the processes and controls that the organization performs when managing their accounts and finances and to perform regular quality assurance reviews on their accounting practices. Auditors may require details of the processes and internal controls and, for organizations having a listing on the US stock exchange, the Sarbanes-Oxley Act places additional requirements on organizations to monitor and record their financial controls to ensure that they have internal control over their financial processes.
In the past, the processes performed by an organization may have been documented and recorded in a simple database. However, as business practices and financial law become more complex, and as questions of accountability should things go wrong become more important, the need has arisen for a more comprehensive suite of tools which permit the ongoing documentation of processes by employees of the organization and of relevant outsourcing agencies. It is also desirable to embed the control environment in the organization so that the control environment can be reviewed and edited as required. Improved communication between those documenting the processes and those carrying out the associated tasks is also important. Users and auditors should also be able to search a database record of processes and of changes to those processes and the information contained in the database should be viewable in a variety of ways either on-screen or in printed reports for improved understanding of the control environment. Embodiments of the present invention address these needs.